data centers and is supported by background-checked U.S. GCC High is the only Microsoft offering - besides the DoD dedicated Microsoft 365 - that insures all data resides in U.S. Microsft 365 GCC High is built on Azure Government, within dedicated US data centers. This free guide to GCC vs GCC High was created to help make informed decisions when choosing between the two platforms. When appropriately leveraged it can help organizations satisfy DFARS 7012, NIST-800-171, and CMMC 2.0 requirements if the organization does not handle export-controlled data such as ITAR and EAR. The major exception is that data stored in the GCC environment of the commercial cloud is segregated from the data used by organizations with Microsoft 365 commercial tenants. The Microsoft 365 GCC environment is almost identical to the Microsoft 365 Commercial environment in capabilities. It leverages the Azure Commercial stack and is generally available through all licensing outlets. However, this offering will not currently meet DFARS 7012 or CMMC 2.0 L2.

This environment is built to FedRAMP High standards and when leveraged properly it can help organizations to meet the requirements found in NIST SP 800-171. The two versions that most organizations lean on for meeting compliance requirements are GCC and GCC high. Although they share many characteristics and capabilities, they all meet compliance requirements differently.

Microsoft has three other environments for Microsoft 365. Yes - we cover this topic in depth in this blog. What is your probability of experiencing an incident or event?.Will you make the switch to GCC High in 1-2 years and possibly require a second migration, security implementation, and assessment? Are you budgeting for that?.Also, Microsoft sheds additional light on DFARS compliance in their cloud offerings when they announced several changes to the accreditation boundaries surrounding Microsoft 365 GCC and Azure Commercial. Previously, Microsoft 365 GCC High was the only version of the Office 365 or Microsoft 365 platform that met the reporting requirements of DFARS 7012 found in paragraphs C-G.ĭo you see your DoD contracts portfolio expanding or including ITAR data? Will you continue to support the DoD? Though DFARS 7012 can sometimes take a backseat to CMMC 2.0 in the public discourse, it's important to take a full compliance vantage point and first consider your organization's DFARS compliance strategy.

Microsoft office for federal employees